What is 'tapjacking' on Android, and which specific API was introduced to allow developers to detect and reject touches made through overlays?

• A.The mitigation for tapjacking is revocation of the SYSTEM_ALERT_WINDOW permission through Settings; Android 10 and later blocks overlay windows from an app that has lost the grant and the platform offers no view-level API for the same purpose (setFilterTouchesWhenObscured was withdrawn in that release together with the legacy overlay types)
• B.Android 12 prevents tapjacking automatically by blocking TYPE_APPLICATION_OVERLAY windows while a foreground activity is visible; the check runs inside WindowManagerService and needs no developer opt-in (setFilterTouchesWhenObscured remains available for pre-Snow Cone releases and for legacy third-party launchers)
• C.Tapjacking is a UI redress attack where a malicious transparent overlay captures or redirects touch events to trick users into tapping hidden UI elements; the setFilterTouchesWhenObscured(true) attribute and View.onFilterTouchEventForSecurity() API allow views to reject touch events when the window is obscured